Windows Analysis Report
ORDER-NEW....pdf.exe

Overview

General Information

Sample Name: ORDER-NEW....pdf.exe
Analysis ID: 557358
MD5: 1baec657210438b896934a7a793c204c
SHA1: 4729717dab3dd01b2ca591c86a02176386e02356
SHA256: b041030454ea89a3ff2326405d3bf230f53daa9ecd50c3e3882a1ad6c0d2427c
Infos:

Detection

HawkEye MailPassView
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected MailPassView
Multi AV Scanner detection for submitted file
Yara detected HawkEye Keylogger
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected HawkEye Rat
Sample uses process hollowing technique
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Writes to foreign memory regions
.NET source code references suspicious native API functions
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file registry)
Machine Learning detection for sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Yara detected WebBrowserPassView password recovery tool
PE file has nameless sections
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to steal Instant Messenger accounts or passwords
Tries to harvest and steal browser information (history, passwords, etc)
PE file contains section with special chars
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Yara detected Credential Stealer
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Enables debug privileges
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
Extensive use of GetProcAddress (often used to hide API calls)
Checks if the current process is being debugged
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Launches processes in debugging mode, may be used to hinder debugging
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: ORDER-NEW....pdf.exe Virustotal: Detection: 62% Perma Link
Source: ORDER-NEW....pdf.exe ReversingLabs: Detection: 93%
Antivirus / Scanner detection for submitted sample
Source: ORDER-NEW....pdf.exe Avira: detected
Antivirus detection for URL or domain
Source: https://a.pomf.cat/ Avira URL Cloud: Label: phishing
Machine Learning detection for sample
Source: ORDER-NEW....pdf.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 5.0.AppLaunch.exe.400000.0.unpack Avira: Label: TR/Dropper.Gen
Source: 5.0.AppLaunch.exe.400000.4.unpack Avira: Label: TR/Dropper.Gen
Source: 5.0.AppLaunch.exe.400000.3.unpack Avira: Label: TR/Dropper.Gen
Source: 5.2.AppLaunch.exe.400000.0.unpack Avira: Label: TR/Dropper.Gen
Source: 5.0.AppLaunch.exe.400000.2.unpack Avira: Label: TR/Dropper.Gen
Source: 5.0.AppLaunch.exe.400000.1.unpack Avira: Label: TR/Dropper.Gen

Compliance
barindex
Uses 32bit PE files
Source: ORDER-NEW....pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: ORDER-NEW....pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: mscorlib.pdbD source: ORDER-NEW....pdf.exe, 00000000.00000000.716149183.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.706455152.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.740808600.00000000082D5000.00000004.00000001.sdmp
Source: Binary string: System.pdbd source: WER450B.tmp.dmp.9.dr
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: ORDER-NEW....pdf.exe, 00000000.00000000.708566677.0000000000EC7000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.698387590.0000000000EC7000.00000004.00000020.sdmp
Source: Binary string: System.Core.ni.pdbRSDSD source: WER450B.tmp.dmp.9.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: ORDER-NEW....pdf.exe, 00000000.00000000.716135209.00000000082D2000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.740801711.00000000082D2000.00000004.00000001.sdmp
Source: Binary string: System.ni.pdbRSDS source: WER450B.tmp.dmp.9.dr
Source: Binary string: c:\Projects\VS2005\WebBrowserPassView\Command-Line\WebBrowserPassView.pdb source: AppLaunch.exe, 00000005.00000002.933455184.0000000007E95000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000002.933674801.0000000009480000.00000004.00020000.sdmp, AppLaunch.exe, 00000005.00000003.692797770.0000000008705000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp, vbc.exe, vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WER450B.tmp.dmp.9.dr
Source: Binary string: .pdb+ source: ORDER-NEW....pdf.exe, 00000000.00000000.708210872.0000000000CF4000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.730094342.0000000000CF4000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb+ source: ORDER-NEW....pdf.exe, 00000000.00000000.716135209.00000000082D2000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.740801711.00000000082D2000.00000004.00000001.sdmp
Source: Binary string: C:\Users\user\Desktop\ORDER-NEW....pdf.PDBh source: ORDER-NEW....pdf.exe, 00000000.00000000.708210872.0000000000CF4000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.730094342.0000000000CF4000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdba source: ORDER-NEW....pdf.exe, 00000000.00000002.730604414.0000000000EC8000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.708566677.0000000000EC7000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.698387590.0000000000EC7000.00000004.00000020.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb* source: ORDER-NEW....pdf.exe, 00000000.00000000.716149183.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.706455152.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.740808600.00000000082D5000.00000004.00000001.sdmp
Source: Binary string: System.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: (P3o0C:\Windows\mscorlib.pdb source: ORDER-NEW....pdf.exe, 00000000.00000000.708210872.0000000000CF4000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.730094342.0000000000CF4000.00000004.00000001.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: System.Core.ni.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: System.Windows.Forms.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: mscorlib.pdb source: ORDER-NEW....pdf.exe, 00000000.00000002.730604414.0000000000EC8000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.708566677.0000000000EC7000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.698387590.0000000000EC7000.00000004.00000020.sdmp, WER450B.tmp.dmp.9.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: ORDER-NEW....pdf.exe, 00000000.00000000.716149183.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.706455152.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.740808600.00000000082D5000.00000004.00000001.sdmp
Source: Binary string: ORDER-NEW....pdf.PDB source: ORDER-NEW....pdf.exe, 00000000.00000000.708210872.0000000000CF4000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.730094342.0000000000CF4000.00000004.00000001.sdmp
Source: Binary string: C:\Users\user\Desktop\ORDER-NEW....pdf.PDB source: ORDER-NEW....pdf.exe, 00000000.00000000.708210872.0000000000CF4000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.730094342.0000000000CF4000.00000004.00000001.sdmp
Source: Binary string: System.Drawing.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: mscorlib.ni.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: c:\Projects\VS2005\mailpv\Command-Line\mailpv.pdb source: AppLaunch.exe, 00000005.00000002.933455184.0000000007E95000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000002.933674801.0000000009480000.00000004.00020000.sdmp, AppLaunch.exe, 00000005.00000002.933041044.0000000006FAE000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000003.692797770.0000000008705000.00000004.00000001.sdmp, vbc.exe, vbc.exe, 00000012.00000000.843177172.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000012.00000000.842483097.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000012.00000002.844335097.0000000000400000.00000040.00000001.sdmp
Source: Binary string: System.Core.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: \??\C:\Users\user\Desktop\ORDER-NEW....pdf.PDB[ source: ORDER-NEW....pdf.exe, 00000000.00000002.730604414.0000000000EC8000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.708566677.0000000000EC7000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.698387590.0000000000EC7000.00000004.00000020.sdmp
Source: Binary string: System.ni.pdb source: WER450B.tmp.dmp.9.dr
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0040938F FindFirstFileW,FindNextFileW,wcslen,wcslen, 8_2_0040938F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00408CAC FindFirstFileW,FindNextFileW,FindClose, 8_2_00408CAC
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_0040702D FindFirstFileA,FindNextFileA,strlen,strlen, 18_2_0040702D
Source: AppLaunch.exe, 00000005.00000002.933455184.0000000007E95000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000002.933674801.0000000009480000.00000004.00020000.sdmp, AppLaunch.exe, 00000005.00000003.692797770.0000000008705000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp, vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp String found in binary or memory: @dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: AppLaunch.exe, 00000005.00000002.933455184.0000000007E95000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000002.933674801.0000000009480000.00000004.00020000.sdmp, AppLaunch.exe, 00000005.00000003.692797770.0000000008705000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp, vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp String found in binary or memory: @dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/beauty|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/food|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/health|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/makers|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/movies|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/music|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/parents|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/politics|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/style|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/tech|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/travel|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com/tv|ntpproviders equals www.yahoo.com (Yahoo)
Source: bhvF129.tmp.8.dr String found in binary or memory: MicrosoftEdge_iecompat:www.yahoo.com|ntpproviders equals www.yahoo.com (Yahoo)
Source: vbc.exe String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: vbc.exe, 00000008.00000003.712462189.00000000022AF000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712859827.00000000022AF000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712423496.00000000022B7000.00000004.00000001.sdmp, bhvF129.tmp.8.dr String found in binary or memory: http://172.217.23.78/
Source: AppLaunch.exe, 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp String found in binary or memory: http://bot.whatismyipaddress.com/
Source: bhvF129.tmp.8.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertECCSecureServerCA.crt0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSecureSiteECCCA-1.crt0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/?name=euconsent&value=&expire=0&isFirstRequest=true
Source: bhvF129.tmp.8.dr String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/onetrust-logo.svg
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl.pki.goog/GTSGIAG3.crl0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl3.digicert.com/DigiCertSecureSiteECCCA-1.crl0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl3.digicert.com/sha2-ev-server-g2.crl04
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl3.digicert.com/ssca-ecc-g1.crl0.
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl4.digicert.com/DigiCertSecureSiteECCCA-1.crl0L
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl4.digicert.com/sha2-ev-server-g2.crl0K
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl4.digicert.com/ssca-ecc-g1.crl0L
Source: bhvF129.tmp.8.dr String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: bhvF129.tmp.8.dr String found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
Source: bhvF129.tmp.8.dr String found in binary or memory: http://google.com/
Source: bhvF129.tmp.8.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IiIsIml1ZSI6Imh0dHA6Ly9pbWFnZXMyLnplbWFudGEuY29tL
Source: bhvF129.tmp.8.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjAxYWZjY2Q0NWJhMmI1MGJkMWJjMzhmMGFlZWM2MDJmMjc2O
Source: bhvF129.tmp.8.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjJkYTFhZDAwNDEyNzQ2M2E3MGUyMWVkZmIxNmUyZjQ2MjBkM
Source: bhvF129.tmp.8.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjU5Zjc4ZGRjN2Y0NThlYzE2YmNhY2E0Y2E2YmFkYzgwNTYyZ
Source: bhvF129.tmp.8.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjVhZWEwOTA0MmYxYzJjMDRlMmU1NDg1YzZmNjY2NTU5N2E5N
Source: bhvF129.tmp.8.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6Ijc4NDFiMmZlNWMxZGU2M2JkNDdjMGQzZWI3NjIzYjlkNWU5N
Source: bhvF129.tmp.8.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6Ijk4OGQ1ZDgwMWE2ODQ2NDNkM2ZkMmYyMGEwOTgwMWQ3MDE2Z
Source: bhvF129.tmp.8.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6ImRjOWViNGY4OTFjMzQ4NTUyMWQyYWZlZDU1MmZmOWI0NzQyN
Source: bhvF129.tmp.8.dr String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6ImYxODk5OTBhOWZjYjFmZjNjNmMxNDhmYjkzM2M3NzY1Mzk3Z
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA61Ofl?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA7XCQ3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AABzUSt?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADsAOZ?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADsZuW?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuG4N?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuQtg?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuTly?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuTp7?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuY5J?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuZko?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuqZ9?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv4Ge?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv842?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbPR?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbce?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvhNP?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvoN9?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyXiwM?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyuliQ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzjSw3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB16g6qc?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17eTok?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18T33l?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18qTPD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19x3nX?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xGDT?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xJbM?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xaUu?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yF6n?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yKf2?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19ylKx?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yuvA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19ywNG?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yxVU?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB46JmN?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB6Ma4a?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBMVUFn?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBO5Geh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBRUB0d?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVuddh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBWoHwx?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBX2afX?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBi9v6?m=6&o=true&u=true&n=true&w=30&h=30
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBih5H?m=6&o=true&u=true&n=true&w=30&h=30
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBkwUr?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnYSFZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BByBEMv?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.digicert.com0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.digicert.com0:
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.digicert.com0B
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.digicert.com0E
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.digicert.com0F
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.digicert.com0K
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.digicert.com0M
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.digicert.com0R
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.msocsp.com0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.pki.goog/GTSGIAG30
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: bhvF129.tmp.8.dr String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: bhvF129.tmp.8.dr String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0#
Source: bhvF129.tmp.8.dr String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0-
Source: bhvF129.tmp.8.dr String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0M
Source: bhvF129.tmp.8.dr String found in binary or memory: http://pki.goog/gsr2/GTSGIAG3.crt0)
Source: AppLaunch.exe, 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp String found in binary or memory: http://pomf.cat/upload.php
Source: ORDER-NEW....pdf.exe, 00000000.00000002.733884470.00000000047C0000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.703620754.0000000005AF1000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000000.689728198.0000000000402000.00000040.00000001.sdmp, AppLaunch.exe, 00000005.00000002.930832405.0000000000402000.00000040.00000001.sdmp String found in binary or memory: http://pomf.cat/upload.php&https://a.pomf.cat/
Source: AppLaunch.exe, 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp String found in binary or memory: http://pomf.cat/upload.phpCContent-Disposition:
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/2366737e/webcore/externalscripts/oneTrust/ski
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/5445db85/webcore/externalscripts/oneTrust/de-
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/3bf20fde-50425371/directi
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/f60532dd-3aac3bb8/directi
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/3bf20fde-2923b6c2/directio
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/3bf20fde-b532f4eb/directio
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-2923b6c2/directio
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-f8dd99d9/directio
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/81/58b810.gif
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/86/2042ed.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA61Ofl.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA7XCQ3.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AABzUSt.img?h=368&w=622
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADsAOZ.img?h=166&w=310
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADsZuW.img?h=166&w=310
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuG4N.img?h=75&w=100&
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuQtg.img?h=166&w=310
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuTly.img?h=166&w=310
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuTp7.img?h=333&w=311
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuY5J.img?h=166&w=310
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuZko.img?h=75&w=100&
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuqZ9.img?h=75&w=100&
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv4Ge.img?h=75&w=100&
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv842.img?h=250&w=300
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbPR.img?h=250&w=300
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbce.img?h=333&w=311
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvhNP.img?h=333&w=311
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvoN9.img?h=166&w=310
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyXiwM.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyuliQ.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzjSw3.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16g6qc.img?h=27&w=27&
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17eTok.img?h=75&w=100
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18T33l.img?h=166&w=31
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18qTPD.img?h=16&w=16&
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19x3nX.img?h=166&w=31
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xGDT.img?h=333&w=31
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xJbM.img?h=75&w=100
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xaUu.img?h=166&w=31
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yF6n.img?h=333&w=31
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yKf2.img?h=250&w=30
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19ylKx.img?h=75&w=100
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yuvA.img?h=250&w=30
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19ywNG.img?h=75&w=100
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yxVU.img?h=166&w=31
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB46JmN.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB6Ma4a.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBMVUFn.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBO5Geh.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBRUB0d.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuddh.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBWoHwx.img?h=27&w=27&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBi9v6.img?m=6&o=true&u
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBkwUr.img?h=16&w=16&m=
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BByBEMv.img?h=16&w=16&m
Source: bhvF129.tmp.8.dr String found in binary or memory: http://support.google.com/accounts/answer/151657
Source: Amcache.hve.9.dr String found in binary or memory: http://upx.sf.net
Source: bhvF129.tmp.8.dr String found in binary or memory: http://www.google.com/
Source: bhvF129.tmp.8.dr String found in binary or memory: http://www.msn.com
Source: bhvF129.tmp.8.dr String found in binary or memory: http://www.msn.com/
Source: vbc.exe, 00000008.00000003.712390571.00000000022AF000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712341279.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712199419.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712142150.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712293496.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712829130.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712034300.00000000022B6000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712693489.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.711967368.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712232690.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712081309.00000000022A2000.00000004.00000001.sdmp, bhvF129.tmp.8.dr String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: bhvF129.tmp.8.dr String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/consent/55a804
Source: bhvF129.tmp.8.dr String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/scripttemplate
Source: vbc.exe, 00000008.00000002.715560522.000000000019C000.00000004.00000001.sdmp String found in binary or memory: http://www.nirsoft.net
Source: vbc.exe, 00000012.00000002.844335097.0000000000400000.00000040.00000001.sdmp String found in binary or memory: http://www.nirsoft.net/
Source: vbc.exe, 00000008.00000003.712859827.00000000022AF000.00000004.00000001.sdmp, bhvF129.tmp.8.dr String found in binary or memory: https://172.217.23.78/
Source: vbc.exe, 00000008.00000003.712390571.00000000022AF000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712341279.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712199419.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712142150.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712293496.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.711936953.00000000022B7000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.711967368.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712232690.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712081309.00000000022A2000.00000004.00000001.sdmp, bhvF129.tmp.8.dr String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;g
Source: bhvF129.tmp.8.dr String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094
Source: AppLaunch.exe, 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp String found in binary or memory: https://a.pomf.cat/
Source: bhvF129.tmp.8.dr String found in binary or memory: https://adservice.google.co.uk/adsid/google/si?gadsid=AORoGNRfxSclVePPTskt_ULwutuxovZBENP6CQBK41sqxH
Source: bhvF129.tmp.8.dr String found in binary or memory: https://adservice.google.co.uk/adsid/google/si?gadsid=AORoGNSN_Te_GQT33AAAR6UNrVcn3a-PGny50bSNsHlzoT
Source: bhvF129.tmp.8.dr String found in binary or memory: https://adservice.google.co.uk/adsid/google/ui?gadsid=AORoGNQXg7AHkvg6J6S0TqGFa_0HynGV3_XxYfs4fLINJG
Source: bhvF129.tmp.8.dr String found in binary or memory: https://adservice.google.co.uk/adsid/google/ui?gadsid=AORoGNRxRJyZzZp4KXfYTC7Z4q4fsi2jmRa8YGEqdB288n
Source: bhvF129.tmp.8.dr String found in binary or memory: https://adservice.google.com/adsid/google/si?gadsid=AORoGNSvKHbjRugN8Bruw1IrFif72u8bwsJvZ4BRSrMAhil_
Source: bhvF129.tmp.8.dr String found in binary or memory: https://adservice.google.com/adsid/google/si?gadsid=AORoGNTzML9SvDOPLAOFxwn751k-3cAoAULy2FWuSRb89C_P
Source: bhvF129.tmp.8.dr String found in binary or memory: https://adservice.google.com/adsid/google/ui
Source: bhvF129.tmp.8.dr String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9
Source: bhvF129.tmp.8.dr String found in binary or memory: https://amp.azure.net/libs/amp/1.8.0/azuremediaplayer.min.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.9Ky5Gf3gP0o.O/m=gapi_iframes
Source: bhvF129.tmp.8.dr String found in binary or memory: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=
Source: bhvF129.tmp.8.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC54c8a2b02c3446f48a60b41e8a5ff47
Source: bhvF129.tmp.8.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC5bdddb231cf54f958a5b6e76e9d8eee
Source: bhvF129.tmp.8.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC828bc1cde9f04b788c98b5423157734
Source: bhvF129.tmp.8.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC9b2d2bc73c8a4a1d8dd5c3d69b6634a
Source: bhvF129.tmp.8.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc13122162a9a46c3b4cbf05ffccde0f
Source: bhvF129.tmp.8.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc71c68d7b8f049b6a6f3b669bd5d00c
Source: bhvF129.tmp.8.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCee0d4d5fd4424c8390d703b105f82c3
Source: bhvF129.tmp.8.dr String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCfd484f9188564713bbc5d13d862ebbf
Source: bhvF129.tmp.8.dr String found in binary or memory: https://assets.adobedtm.com/launch-EN7b3d710ac67a4a1195648458258f97dd.min.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: vbc.exe, 00000008.00000003.712390571.00000000022AF000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712341279.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712199419.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712142150.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712293496.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.711936953.00000000022B7000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.711967368.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712232690.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712081309.00000000022A2000.00000004.00000001.sdmp, bhvF129.tmp.8.dr String found in binary or memory: https://consent.google.com/?hl=en-GB&origin=https://www.google.com&continue=https://www.google.com/?
Source: bhvF129.tmp.8.dr String found in binary or memory: https://consent.google.com/done8?continue=https://www.google.com/?gws_rd%3Dssl&origin=https://www.go
Source: bhvF129.tmp.8.dr String found in binary or memory: https://consent.google.com/set?pc=s&uxe=4421591
Source: bhvF129.tmp.8.dr String found in binary or memory: https://contextual.media.net/
Source: bhvF129.tmp.8.dr String found in binary or memory: https://contextual.media.net/48/nrrV18753.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3
Source: bhvF129.tmp.8.dr String found in binary or memory: https://contextual.media.net/__media__/js/util/nrrV9140.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: bhvF129.tmp.8.dr String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: bhvF129.tmp.8.dr String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: bhvF129.tmp.8.dr String found in binary or memory: https://cvision.media.net/new/100x75/2/249/241/157/ab7b8862-dfb2-4e59-a214-ff623600dbf5.jpg?v=9
Source: bhvF129.tmp.8.dr String found in binary or memory: https://cvision.media.net/new/100x75/2/89/162/29/8ee7a9a3-dec9-4d15-94e1-5c73b17d2de1.jpg?v=9
Source: bhvF129.tmp.8.dr String found in binary or memory: https://cvision.media.net/new/100x75/3/148/118/158/6d596081-b574-4a8a-9662-8f180c6f659f.jpg?v=9
Source: bhvF129.tmp.8.dr String found in binary or memory: https://cvision.media.net/new/286x175/2/249/241/157/ab7b8862-dfb2-4e59-a214-ff623600dbf5.jpg?v=9
Source: bhvF129.tmp.8.dr String found in binary or memory: https://cvision.media.net/new/286x175/3/148/118/158/6d596081-b574-4a8a-9662-8f180c6f659f.jpg?v=9
Source: bhvF129.tmp.8.dr String found in binary or memory: https://cvision.media.net/new/300x300/2/41/100/83/b5cbfa68-1c93-41c9-8797-4f9b532bc0b6.jpg?v=9
Source: bhvF129.tmp.8.dr String found in binary or memory: https://cvision.media.net/new/300x300/3/167/174/27/39ab3103-8560-4a55-bfc4-401f897cf6f2.jpg?v=9
Source: bhvF129.tmp.8.dr String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: bhvF129.tmp.8.dr String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B83C84637
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQE7dARJDf70CVtvXguPcFi4kAoAFTTEX3FZ_Kd&s=0
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQEZeIjizh9n8teY_8BOjsYtpLHwSdIq3PT-WQtot4&s=10
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQFso5PEv3c0kRR2gODJUq62DZF6fnxNsqKUTBX-00QeuCR
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQJBttAzO3yKFNSKzEm8qyQoBw2vbSHn0xMB0yhbgc&s=10
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQSkA3BhTLNTXreS8GxkTmsFGydHUKxWR3gtSn5&s=0
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQYaLHOGeTAvxcl2Kvu_RGdrblf1tOpndi7m5_OMgFvfzlI
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQc9-XcC69nXJpriIbLos4bSDdjrz_nByi2zL9xxJ4&s=10
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQcijPNIB_ZGSU0DrjPI_tJ1YOI-6PHUbyHUjTLi3M5nnkK
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQehqYcvOrRcw1YORGnrCzHbNyjMegefhpqYrPQO8G2_KPc
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQyeaAiOCtrhzoyiUuHOZcp67UWv4aYiYIKZ629tWqIyQ_l
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcR6qDJUCBqqO8k81oIRUuLKwKNP-ux5oIGn1btf&s=0
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRXMqY1lU5NXqI7H2QRWgHFAYTsfVdew3_6QMhtv0g&s=10
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRZaO1x4iyU-YgxgvuerXdFmXdj8Ce3rNy8Mqw2SlqePXDg
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRlHYHZu1FxxbUNbpii9NbSF3wy4srqmfLAOC-QBxw&s
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcS2yfg_cFEuqKFbNZCaFykqy-jW3vHyGM224t0Sov33iXvh
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcS7Tsy61sPGCiV6yILYtCYyP2q9i9bHmXBPqktk0xQvTH0l
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcS9bnSRFZj9kLnT0CeZ7r27C9IrO3sFLnQL62gz&s=0
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSHEjIxVJou5NRecC2n_FnHaUJDfppR3IDOglu2Ry9INoxt
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSKx7_Dt9K5OFgp-raiLw2XdVNOTbR27N_DCL6T8VDVN_16
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSTkM_f5rN2hSSg3E_UshkUpgZ0a66Lz0rF6gF6&s=0
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcScI5035wSfgyvpN8fX27BnFHfF4a7I8z7Xlm7v&s=0
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSpNsTsg--kCoAxXjTvRrABIfJjd5ITzVx14ODQUC4wDGzB
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSrCEL2r-B2oHHnS0EeiVjQLJYayeF4GHjCZod9vr4&s
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSvX77JsybkskW6WoLj5kY6exJKuOkXoRWSsNgJbFY&s
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcT9-gm37CbSVQ1QMRdyqOvdY12lHBO7fXpaqZZqKP2Wbjr2
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTKoe8A2_V1bWtOlP5fx10ZdjsJZv6l2_sKjTp6jVAPnp0g
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcThUknsbAksExwESRgK7TW5ujPLzgeGDT0-A3f5a1XrdyR-
Source: bhvF129.tmp.8.dr String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTo0t2j428kWHZlc2etqXbsI-zLrpgSp87E2H24&s=0
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwA.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UaGrENHsxJlGDuGo1OIlI3K.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UabrENHsxJlGDuGo1OIlLU94bt3.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc-.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9vAA.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Me5g.woff
Source: bhvF129.tmp.8.dr String found in binary or memory: https://fp.msedge.net/conf/v1/asgw/fpconfig.min.json
Source: bhvF129.tmp.8.dr String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: bhvF129.tmp.8.dr String found in binary or memory: https://googleads.g.doubleclick.net/adsid/google/si?gadsid=AORoGNQXwBwQrE_SUsnWzwpadcOOdc8yOg6JxthQN
Source: bhvF129.tmp.8.dr String found in binary or memory: https://googleads.g.doubleclick.net/adsid/google/si?gadsid=AORoGNTXuGHPo1zFjYPXt7mTG-4GALGGk8bjqjvBm
Source: bhvF129.tmp.8.dr String found in binary or memory: https://googleads.g.doubleclick.net/adsid/google/ui?gadsid=AORoGNQP1yCl9r5iywZTFTjpazv-DURVxDidzMfrF
Source: bhvF129.tmp.8.dr String found in binary or memory: https://googleads.g.doubleclick.net/adsid/google/ui?gadsid=AORoGNSrZsXAj6n_sYvivJecwrpYgMhb9ihVGAlz2
Source: bhvF129.tmp.8.dr String found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DnuZ
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnv6
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnwt
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DsDH
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmQ
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmV
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmZ
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FGwC
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n1yl
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n4cm
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJ7
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJa
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4nqTh
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4sQww?ver=37ff
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tD2S
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tG3O
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoW
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoY
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tKUA
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOD
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOM
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tQVa
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4u1kF
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ubMD
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqj5
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4zuiC
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWeTGO?ver=8c74&q=90&m=
Source: bhvF129.tmp.8.dr String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: bhvF129.tmp.8.dr String found in binary or memory: https://lh5.googleusercontent.com/p/AF1QipOcdIDtTfqJElTfRhjdFP9dPcYlW61iEhrydiuX=w92-h92-n-k-no
Source: bhvF129.tmp.8.dr String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: bhvF129.tmp.8.dr String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: vbc.exe String found in binary or memory: https://login.yahoo.com/config/login
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/ConvergedLoginPaginatedStrings.en.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/ConvergedLogin_PCore.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/Converged_v21033.css
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/MeControl.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/images/ellipsis_white.svg?x=5ac590ee72bfe06a7cecfd75b588
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b5
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc1937
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v21033_-0mnSwu67knBd7qR7YN9GQ2.css
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_5QoHC_ilFOmb96M0pIeJ
Source: bhvF129.tmp.8.dr String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/OldConvergedLogin_PCore_xqcDwEKeDux9oCNjuqEZ-A2.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://maps.windows.com/windows-app-web-link
Source: bhvF129.tmp.8.dr String found in binary or memory: https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meBoot.min.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meCore.min.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://mem.gfx.ms/meversion?partner=RetailStore2&market=en-us&uhf=1
Source: bhvF129.tmp.8.dr String found in binary or memory: https://mwf-service.akamaized.net/mwf/css/bundle/1.57.0/west-european/default/mwf-main.min.css
Source: bhvF129.tmp.8.dr String found in binary or memory: https://mwf-service.akamaized.net/mwf/js/bundle/1.57.0/mwf-auto-init-main.var.min.js
Source: vbc.exe, 00000008.00000003.712390571.00000000022AF000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712341279.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712199419.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712142150.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712293496.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.711936953.00000000022B7000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.711967368.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712232690.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712081309.00000000022A2000.00000004.00000001.sdmp, bhvF129.tmp.8.dr String found in binary or memory: https://ogs.google.com/widget/callout?prid=19020392&pgid=19020380&puid=93eb0881ae9ec1db&origin=https
Source: bhvF129.tmp.8.dr String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2019-06-26-21-10-17/PreSignInSettingsConfig.json
Source: bhvF129.tmp.8.dr String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2019-06-26-21-10-17/PreSignInSettingsConfig.json?One
Source: bhvF129.tmp.8.dr String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2020-07-22-21-45-19/PreSignInSettingsConfig.json?One
Source: bhvF129.tmp.8.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/19.086.0502.0006/OneDriveSetup.exe
Source: bhvF129.tmp.8.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/19.103.0527.0003/update1.xml?OneDriveUpdate=d580ab8fe35aabd7f368aa
Source: bhvF129.tmp.8.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/20.124.0621.0006/update1.xml?OneDriveUpdate=285df6c9c501a160c7a24c
Source: bhvF129.tmp.8.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/20.124.0621.0006/update1.xml?OneDriveUpdate=4a941ab240f8b2c5ca3ca1
Source: bhvF129.tmp.8.dr String found in binary or memory: https://onecs-live.azureedge.net/api/settings/en-US/xml/settings-tipset?release=rs4
Source: bhvF129.tmp.8.dr String found in binary or memory: https://optanon.blob.core.windows.net/skins/4.1.0/default_flat_top_two_button_black/v2/css/optanon.c
Source: bhvF129.tmp.8.dr String found in binary or memory: https://optanon.blob.core.windows.net/skins/4.1.0/default_flat_top_two_button_black/v2/images/cookie
Source: bhvF129.tmp.8.dr String found in binary or memory: https://pki.goog/repository/0
Source: bhvF129.tmp.8.dr String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml
Source: bhvF129.tmp.8.dr String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/vhs/api/videos/RE4sQBc
Source: bhvF129.tmp.8.dr String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: bhvF129.tmp.8.dr String found in binary or memory: https://s.yimg.com/lo/api/res/1.2/BXjlWewXmZ47HeV5NPvUYA--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1
Source: bhvF129.tmp.8.dr String found in binary or memory: https://srtb.msn.com/auction?a=de-ch&b=28e3747a031f4b2a8498142b7c961529&c=MSN&d=http%3A%2F%2Fwww.msn
Source: bhvF129.tmp.8.dr String found in binary or memory: https://ssl.gstatic.com/gb/images/i1_1967ca6a.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://statics-marketingsites-neu-ms-com.akamaized.net/statics/override.css?c=7
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google-analytics.com/gtm/js?id=GTM-N7S69J3&cid=993498051.1601450642
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/?gws_rd=ssl
Source: vbc.exe String found in binary or memory: https://www.google.com/accounts/servicelogin
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/async/bgasy?ei=gTJ0X7zPLY2f1fAPlo2xoAI&yv=3&async=_fmt:jspb
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/css/main.v2.min.css
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/css/main.v3.min.css
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/app-store-download.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/chrome-logo.svg
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/chrome_throbber_fast.gif
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/cursor-replay.cur
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/big_pixel_phone.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_phone.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_tablet.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-chrome-logo.jpg
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-logo-one-color.jpg
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-fb.jpg
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-help.jpg
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-twitter.jpg
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-youtube.jpg
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/google-play-download.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-beta.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-canary.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-dev.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-enterprise.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-bottom-left.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-middle.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-top-right.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_features.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_privacy.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_tools.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/homepage/laptop_desktop.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/images/thank-you/thankyou-animation.json
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/js/installer.min.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/chrome/static/js/main.v2.min.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/complete/search?q&cp=0&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser=0&pq
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/complete/search?q&cp=0&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser=0&ps
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/complete/search?q=c&cp=1&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser=0&
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/complete/search?q=ch&cp=2&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser=0
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/complete/search?q=chr&cp=3&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser=
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/complete/search?q=chro&cp=4&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuser
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/complete/search?q=chrom&cp=5&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authuse
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/complete/search?q=chrome&cp=6&client=psy-ab&xssi=t&gs_ri=gws-wiz&hl=en&authus
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/favicon.ico
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_92x30dp.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/images/hpp/Chrome_Owned_96x96.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/images/icons/material/system/1x/email_grey600_24dp.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/images/nav_logo299.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/images/phd/px.gif
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/images/searchbox/desktop_searchbox_sprites302_hr.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/intl/en_uk/chrome/
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/intl/en_uk/chrome/application/x-msdownloadC:
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/intl/en_uk/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrows
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/js/bg/4sIGg4Q0MrxdMwjTwsyJBGUAZbljSmH8-8Fa9_hVOC0.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/search
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/search?source=hp&ei=djJ0X6TKCL6IjLsPqriogAY&q=chrome&oq=chrome&gs_lcp=CgZwc3k
Source: vbc.exe, 00000008.00000003.712390571.00000000022AF000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712341279.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712199419.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712142150.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712293496.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.711936953.00000000022B7000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.711967368.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712232690.00000000022A2000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712081309.00000000022A2000.00000004.00000001.sdmp, bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwj8k7G9rJDsAhWNTxUIHZZGDCQQ
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/xjs/_/js/k=xjs.s.en_GB.u8fwEfmm86E.O/ck=xjs.s.hyRG9kR79v8.L.I11.O/am=AAAAAABA
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.google.com/xjs/_/js/k=xjs.s.en_GB.u8fwEfmm86E.O/ck=xjs.s.hyRG9kR79v8.L.I11.O/m=IvlUe
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.googleadservices.com/pagead/conversion.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.googleadservices.com/pagead/conversion_async.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-PZ6TRJB
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en_GB.wmTUy5P6FUM.es5.O/ck=
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.bMYZ6MazNlM.
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/ac/cb/cb_cbu_kickin.svg
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/external_hosted/autotrack/autotrack.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/external_hosted/lottie/lottie.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/ScrollMagic.min.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/animation.gsap.min.js
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_92x36dp.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/check_black_24dp.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/keyboard_arrow_down_grey600_24dp.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/kpui/social/fb_32x32.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/kpui/social/twitter_32x32.png
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.og2.en_US.vA2d_upwXfg.O/rt=j/m=def
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.LGkrjG2a9yI.O/rt=j/m=qabr
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.CniBF78B8Ew.L.X.O/m=qcwid/excm=qaaw
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.gstatic.com/ui/v1/activityindicator/loading_24.gif
Source: vbc.exe, 00000008.00000003.712462189.00000000022AF000.00000004.00000001.sdmp, vbc.exe, 00000008.00000003.712423496.00000000022B7000.00000004.00000001.sdmp, bhvF129.tmp.8.dr String found in binary or memory: https://www.msn.com/
Source: bhvF129.tmp.8.dr String found in binary or memory: https://www.msn.com/spartan/dhp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&ishostisol

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected HawkEye Keylogger
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.689728198.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.930832405.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.690486770.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.703620754.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.690115034.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.733884470.00000000047C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.702281950.00000000047C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.691070548.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.712572110.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.738563781.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.711229338.00000000047C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ORDER-NEW....pdf.exe PID: 6860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 7160, type: MEMORYSTR
Contains functionality for read data from the clipboard
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0040F078 OpenClipboard,GetLastError,DeleteFileW, 8_2_0040F078

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 18.0.vbc.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.0.AppLaunch.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 5.0.AppLaunch.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 18.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 18.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 5.0.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 18.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 5.0.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 18.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 18.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.2.AppLaunch.exe.7f31990.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 5.0.AppLaunch.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 5.0.AppLaunch.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.2.AppLaunch.exe.9480000.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.2.AppLaunch.exe.94d834a.4.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 5.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 5.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.2.AppLaunch.exe.9480000.3.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 5.3.AppLaunch.exe.875dbda.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 5.2.AppLaunch.exe.7f31990.2.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 18.0.vbc.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 5.2.AppLaunch.exe.7e95950.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.2.AppLaunch.exe.9480345.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 18.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 18.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.0.AppLaunch.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 5.0.AppLaunch.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.2.AppLaunch.exe.94d834a.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 18.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 18.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.3.AppLaunch.exe.8705890.0.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 5.3.AppLaunch.exe.875dbda.2.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 18.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 5.0.AppLaunch.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 5.0.AppLaunch.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.3.AppLaunch.exe.8705bd5.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 5.3.AppLaunch.exe.8705890.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.raw.unpack, type: UNPACKEDPE Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 00000005.00000000.689728198.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000005.00000002.930832405.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000012.00000000.843177172.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000005.00000000.690486770.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000012.00000000.842827239.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000005.00000002.933674801.0000000009480000.00000004.00020000.sdmp, type: MEMORY Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000000.00000000.703620754.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000012.00000000.842483097.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000005.00000000.690115034.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000000.00000002.733884470.00000000047C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000000.00000000.702281950.00000000047C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000012.00000000.843631196.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000005.00000000.691070548.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000012.00000002.844335097.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000000.00000000.712572110.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000000.00000002.738563781.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000000.00000000.711229338.00000000047C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: Process Memory Space: ORDER-NEW....pdf.exe PID: 6860, type: MEMORYSTR Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: Process Memory Space: AppLaunch.exe PID: 7160, type: MEMORYSTR Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: ORDER-NEW....pdf.exe
Source: initial sample Static PE information: Filename: ORDER-NEW....pdf.exe
PE file has nameless sections
Source: ORDER-NEW....pdf.exe Static PE information: section name:
PE file contains section with special chars
Source: ORDER-NEW....pdf.exe Static PE information: section name: )xrUhX
Uses 32bit PE files
Source: ORDER-NEW....pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 18.0.vbc.exe.400000.4.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.0.AppLaunch.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 5.0.AppLaunch.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 5.0.AppLaunch.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 18.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 18.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 5.0.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 5.0.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 18.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 5.0.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 18.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 18.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.2.AppLaunch.exe.7f31990.2.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 5.0.AppLaunch.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 5.0.AppLaunch.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 5.0.AppLaunch.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.2.AppLaunch.exe.9480000.3.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.2.AppLaunch.exe.94d834a.4.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 5.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 5.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 5.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.2.AppLaunch.exe.9480000.3.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 5.3.AppLaunch.exe.875dbda.2.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 5.2.AppLaunch.exe.7f31990.2.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 18.0.vbc.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 5.2.AppLaunch.exe.7e95950.1.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.2.AppLaunch.exe.9480345.5.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 18.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 18.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.0.AppLaunch.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 5.0.AppLaunch.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 5.0.AppLaunch.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.2.AppLaunch.exe.94d834a.4.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 18.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 18.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.3.AppLaunch.exe.8705890.0.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 5.3.AppLaunch.exe.875dbda.2.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 18.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 5.0.AppLaunch.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 5.0.AppLaunch.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 5.0.AppLaunch.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.3.AppLaunch.exe.8705bd5.1.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 5.3.AppLaunch.exe.8705890.0.raw.unpack, type: UNPACKEDPE Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.raw.unpack, type: UNPACKEDPE Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.raw.unpack, type: UNPACKEDPE Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 00000005.00000000.689728198.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000005.00000002.930832405.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000012.00000000.843177172.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000005.00000000.690486770.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000012.00000000.842827239.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000005.00000002.933674801.0000000009480000.00000004.00020000.sdmp, type: MEMORY Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000000.00000000.703620754.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000012.00000000.842483097.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000005.00000000.690115034.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000000.00000002.733884470.00000000047C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000000.00000000.702281950.00000000047C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000012.00000000.843631196.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000005.00000000.691070548.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000012.00000002.844335097.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000000.00000000.712572110.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000000.00000002.738563781.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000000.00000000.711229338.00000000047C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: Process Memory Space: ORDER-NEW....pdf.exe PID: 6860, type: MEMORYSTR Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: Process Memory Space: AppLaunch.exe PID: 7160, type: MEMORYSTR Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
One or more processes crash
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 1156
Detected potential crypto function
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Code function: 0_2_008A4762 0_2_008A4762
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Code function: 0_2_012104E9 0_2_012104E9
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Code function: 0_2_01210E70 0_2_01210E70
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Code function: 0_2_012118A0 0_2_012118A0
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Code function: 0_2_012173A2 0_2_012173A2
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Code function: 0_2_012173B0 0_2_012173B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054304D8 5_2_054304D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054354B8 5_2_054354B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05432068 5_2_05432068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05430C48 5_2_05430C48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05436C29 5_2_05436C29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05439F98 5_2_05439F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05439938 5_2_05439938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054338E6 5_2_054338E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05438540 5_2_05438540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05430562 5_2_05430562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433564 5_2_05433564
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433568 5_2_05433568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05434519 5_2_05434519
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05434528 5_2_05434528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05438531 5_2_05438531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_0543053B 5_2_0543053B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054305ED 5_2_054305ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054305A6 5_2_054305A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_0543E45F 5_2_0543E45F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_0543174D 5_2_0543174D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054317D4 5_2_054317D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05434168 5_2_05434168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05434178 5_2_05434178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_0543E1B8 5_2_0543E1B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_0543E30B 5_2_0543E30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433D40 5_2_05433D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05431D6F 5_2_05431D6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433DDD 5_2_05433DDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433DA0 5_2_05433DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433C73 5_2_05433C73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433C1D 5_2_05433C1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05430C35 5_2_05430C35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05431C83 5_2_05431C83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05431CBA 5_2_05431CBA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433E75 5_2_05433E75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05436E10 5_2_05436E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433E1A 5_2_05433E1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05431E95 5_2_05431E95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05439928 5_2_05439928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054339D7 5_2_054339D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054329E9 5_2_054329E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054319F6 5_2_054319F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054329F8 5_2_054329F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433981 5_2_05433981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054348D0 5_2_054348D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054348E0 5_2_054348E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054318FB 5_2_054318FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_0543588B 5_2_0543588B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05435890 5_2_05435890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433B60 5_2_05433B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433B1E 5_2_05433B1E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433BCE 5_2_05433BCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433BF1 5_2_05433BF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05431BB9 5_2_05431BB9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433A77 5_2_05433A77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433A02 5_2_05433A02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433ADD 5_2_05433ADD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05433AAA 5_2_05433AAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C3B990 5_2_09C3B990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C34C00 5_2_09C34C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C30040 5_2_09C30040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C34310 5_2_09C34310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C362B8 5_2_09C362B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C38B60 5_2_09C38B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C38B70 5_2_09C38B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C33FC0 5_2_09C33FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C39080 5_2_09C39080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C39090 5_2_09C39090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C3001C 5_2_09C3001C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C34304 5_2_09C34304
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C3C2C6 5_2_09C3C2C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09C3C2C8 5_2_09C3C2C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E315DB 5_2_09E315DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E314DD 5_2_09E314DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E31415 5_2_09E31415
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E30778 5_2_09E30778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E30EA8 5_2_09E30EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E31295 5_2_09E31295
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E31174 5_2_09E31174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E31134 5_2_09E31134
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E3170B 5_2_09E3170B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E312D5 5_2_09E312D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E31667 5_2_09E31667
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E3125A 5_2_09E3125A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0044900F 8_2_0044900F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_004042EB 8_2_004042EB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00414281 8_2_00414281
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00410291 8_2_00410291
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_004063BB 8_2_004063BB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00415624 8_2_00415624
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0041668D 8_2_0041668D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0040477F 8_2_0040477F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0040487C 8_2_0040487C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0043589B 8_2_0043589B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0043BA9D 8_2_0043BA9D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0043FBD3 8_2_0043FBD3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_00404DE5 18_2_00404DE5
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_00404E56 18_2_00404E56
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_00404EC7 18_2_00404EC7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_00404F58 18_2_00404F58
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_0040BF6B 18_2_0040BF6B
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: String function: 00415F19 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: String function: 0044468C appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: String function: 004162C2 appears 87 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: String function: 00412084 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: String function: 00444B90 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: String function: 0041607A appears 66 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: String function: 004083D6 appears 32 times
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_09E31398 NtUnmapViewOfSection, 5_2_09E31398
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0040978A memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle, 8_2_0040978A
Sample file is different than original file name gathered from version info
Source: ORDER-NEW....pdf.exe Binary or memory string: OriginalFilename vs ORDER-NEW....pdf.exe
Source: ORDER-NEW....pdf.exe, 00000000.00000002.733884470.00000000047C0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameReborn Stub.exe" vs ORDER-NEW....pdf.exe
Source: ORDER-NEW....pdf.exe, 00000000.00000002.733095475.0000000003C71000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameFm.dll& vs ORDER-NEW....pdf.exe
Source: ORDER-NEW....pdf.exe, 00000000.00000000.703620754.0000000005AF1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameReborn Stub.exe" vs ORDER-NEW....pdf.exe
Source: ORDER-NEW....pdf.exe, 00000000.00000000.699217663.0000000002C20000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameFm.dll& vs ORDER-NEW....pdf.exe
Source: ORDER-NEW....pdf.exe, 00000000.00000000.709923346.0000000002C71000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameclsRP.dll, vs ORDER-NEW....pdf.exe
Source: ORDER-NEW....pdf.exe, 00000000.00000000.709923346.0000000002C71000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameReborn Stub.exe" vs ORDER-NEW....pdf.exe
Source: ORDER-NEW....pdf.exe, 00000000.00000000.709383685.0000000001240000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameclsRP.dll, vs ORDER-NEW....pdf.exe
Source: ORDER-NEW....pdf.exe, 00000000.00000000.662259035.00000000008A6000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameORDER-NEW.exeT vs ORDER-NEW....pdf.exe
Source: ORDER-NEW....pdf.exe Binary or memory string: OriginalFilenameORDER-NEW.exeT vs ORDER-NEW....pdf.exe
Source: ORDER-NEW....pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ORDER-NEW....pdf.exe Static PE information: Section: )xrUhX ZLIB complexity 1.00031528433
Source: ORDER-NEW....pdf.exe Virustotal: Detection: 62%
Source: ORDER-NEW....pdf.exe ReversingLabs: Detection: 93%
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe File read: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\ORDER-NEW....pdf.exe "C:\Users\user\Desktop\ORDER-NEW....pdf.exe"
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpB254.tmp
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 1156
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 1156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpB202.tmp
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 1156 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpB254.tmp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpB202.tmp Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe System information queried: HandleInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe File created: C:\Users\user\AppData\Local\Temp\7e8a2afc-e75b-3dcf-f7ef-7d8629ca2b45 Jump to behavior
Source: classification engine Classification label: mal100.phis.troj.spyw.evad.winEXE@11/9@0/0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00418073 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free, 8_2_00418073
Source: vbc.exe, vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: vbc.exe, vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: vbc.exe, vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: vbc.exe, vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: vbc.exe, vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: vbc.exe, vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: 5.0.AppLaunch.exe.400000.2.unpack, u200b????????????????????????????????????????.cs Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.0.AppLaunch.exe.400000.0.unpack, u200b????????????????????????????????????????.cs Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.2.AppLaunch.exe.400000.0.unpack, u200d????????????????????????????????????????.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.2.AppLaunch.exe.400000.0.unpack, u200d????????????????????????????????????????.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.AppLaunch.exe.400000.3.unpack, u200b????????????????????????????????????????.cs Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.0.AppLaunch.exe.400000.0.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void Microsoft.Win32.RegistryKey::SetAccessControl(System.Security.AccessControl.RegistrySecurity)
Source: 5.0.AppLaunch.exe.400000.0.unpack, u202a????????????????????????????????????????.cs Security API names: System.Security.Principal.IdentityReference System.Security.Principal.SecurityIdentifier::Translate(System.Type)
Source: 5.0.AppLaunch.exe.400000.0.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void System.Security.AccessControl.RegistrySecurity::AddAccessRule(System.Security.AccessControl.RegistryAccessRule)
Source: 5.0.AppLaunch.exe.400000.3.unpack, u200d????????????????????????????????????????.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.AppLaunch.exe.400000.3.unpack, u200d????????????????????????????????????????.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.AppLaunch.exe.400000.1.unpack, u200b????????????????????????????????????????.cs Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.0.AppLaunch.exe.400000.2.unpack, u200d????????????????????????????????????????.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.AppLaunch.exe.400000.2.unpack, u200d????????????????????????????????????????.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.AppLaunch.exe.400000.0.unpack, u200d????????????????????????????????????????.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.AppLaunch.exe.400000.0.unpack, u200d????????????????????????????????????????.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.AppLaunch.exe.400000.4.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void Microsoft.Win32.RegistryKey::SetAccessControl(System.Security.AccessControl.RegistrySecurity)
Source: 5.0.AppLaunch.exe.400000.4.unpack, u202a????????????????????????????????????????.cs Security API names: System.Security.Principal.IdentityReference System.Security.Principal.SecurityIdentifier::Translate(System.Type)
Source: 5.0.AppLaunch.exe.400000.4.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void System.Security.AccessControl.RegistrySecurity::AddAccessRule(System.Security.AccessControl.RegistryAccessRule)
Source: 5.2.AppLaunch.exe.400000.0.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void Microsoft.Win32.RegistryKey::SetAccessControl(System.Security.AccessControl.RegistrySecurity)
Source: 5.2.AppLaunch.exe.400000.0.unpack, u202a????????????????????????????????????????.cs Security API names: System.Security.Principal.IdentityReference System.Security.Principal.SecurityIdentifier::Translate(System.Type)
Source: 5.2.AppLaunch.exe.400000.0.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void System.Security.AccessControl.RegistrySecurity::AddAccessRule(System.Security.AccessControl.RegistryAccessRule)
Source: 5.0.AppLaunch.exe.400000.1.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void Microsoft.Win32.RegistryKey::SetAccessControl(System.Security.AccessControl.RegistrySecurity)
Source: 5.0.AppLaunch.exe.400000.1.unpack, u202a????????????????????????????????????????.cs Security API names: System.Security.Principal.IdentityReference System.Security.Principal.SecurityIdentifier::Translate(System.Type)
Source: 5.0.AppLaunch.exe.400000.1.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void System.Security.AccessControl.RegistrySecurity::AddAccessRule(System.Security.AccessControl.RegistryAccessRule)
Source: 5.0.AppLaunch.exe.400000.3.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void Microsoft.Win32.RegistryKey::SetAccessControl(System.Security.AccessControl.RegistrySecurity)
Source: 5.0.AppLaunch.exe.400000.3.unpack, u202a????????????????????????????????????????.cs Security API names: System.Security.Principal.IdentityReference System.Security.Principal.SecurityIdentifier::Translate(System.Type)
Source: 5.0.AppLaunch.exe.400000.3.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void System.Security.AccessControl.RegistrySecurity::AddAccessRule(System.Security.AccessControl.RegistryAccessRule)
Source: 5.0.AppLaunch.exe.400000.1.unpack, u200d????????????????????????????????????????.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.AppLaunch.exe.400000.1.unpack, u200d????????????????????????????????????????.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.AppLaunch.exe.400000.0.unpack, u200b????????????????????????????????????????.cs Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.0.AppLaunch.exe.400000.4.unpack, u200b????????????????????????????????????????.cs Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 5.0.AppLaunch.exe.400000.4.unpack, u200d????????????????????????????????????????.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 5.0.AppLaunch.exe.400000.4.unpack, u200d????????????????????????????????????????.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.0.AppLaunch.exe.400000.2.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void Microsoft.Win32.RegistryKey::SetAccessControl(System.Security.AccessControl.RegistrySecurity)
Source: 5.0.AppLaunch.exe.400000.2.unpack, u202a????????????????????????????????????????.cs Security API names: System.Security.Principal.IdentityReference System.Security.Principal.SecurityIdentifier::Translate(System.Type)
Source: 5.0.AppLaunch.exe.400000.2.unpack, u202a????????????????????????????????????????.cs Security API names: System.Void System.Security.AccessControl.RegistrySecurity::AddAccessRule(System.Security.AccessControl.RegistryAccessRule)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00417BE9 GetLastError,FormatMessageW,FormatMessageA,LocalFree,free, 8_2_00417BE9
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00413424 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,free,Process32NextW,CloseHandle, 8_2_00413424
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Mutant created: \Sessions\1\BaseNamedObjects\714e5fbb-f83f-4388-95bc-ab8eaa6f89ea
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_004141E0 FindResourceW,SizeofResource,LoadResource,LockResource, 8_2_004141E0
Source: 5.0.AppLaunch.exe.400000.0.unpack, u202d????????????????????????????????????????.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.AppLaunch.exe.400000.0.unpack, u202d????????????????????????????????????????.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.AppLaunch.exe.400000.0.unpack, u202d????????????????????????????????????????.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.AppLaunch.exe.400000.0.unpack, u206b????????????????????????????????????????.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.AppLaunch.exe.400000.4.unpack, u202d????????????????????????????????????????.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.AppLaunch.exe.400000.4.unpack, u202d????????????????????????????????????????.cs Cryptographic APIs: 'CreateDecryptor'
Source: 5.0.AppLaunch.exe.400000.4.unpack, u202d????????????????????????????????????????.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.AppLaunch.exe.400000.4.unpack, u206b????????????????????????????????????????.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.AppLaunch.exe.400000.3.unpack, u206b????????????????????????????????????????.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.AppLaunch.exe.400000.3.unpack, u202d????????????????????????????????????????.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.0.AppLaunch.exe.400000.3.unpack, u202d????????????????????????????????????????.cs Cryptographic APIs: 'CreateDecryptor'
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Jump to behavior
Source: ORDER-NEW....pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: ORDER-NEW....pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: mscorlib.pdbD source: ORDER-NEW....pdf.exe, 00000000.00000000.716149183.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.706455152.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.740808600.00000000082D5000.00000004.00000001.sdmp
Source: Binary string: System.pdbd source: WER450B.tmp.dmp.9.dr
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: ORDER-NEW....pdf.exe, 00000000.00000000.708566677.0000000000EC7000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.698387590.0000000000EC7000.00000004.00000020.sdmp
Source: Binary string: System.Core.ni.pdbRSDSD source: WER450B.tmp.dmp.9.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: ORDER-NEW....pdf.exe, 00000000.00000000.716135209.00000000082D2000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.740801711.00000000082D2000.00000004.00000001.sdmp
Source: Binary string: System.ni.pdbRSDS source: WER450B.tmp.dmp.9.dr
Source: Binary string: c:\Projects\VS2005\WebBrowserPassView\Command-Line\WebBrowserPassView.pdb source: AppLaunch.exe, 00000005.00000002.933455184.0000000007E95000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000002.933674801.0000000009480000.00000004.00020000.sdmp, AppLaunch.exe, 00000005.00000003.692797770.0000000008705000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp, vbc.exe, vbc.exe, 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WER450B.tmp.dmp.9.dr
Source: Binary string: .pdb+ source: ORDER-NEW....pdf.exe, 00000000.00000000.708210872.0000000000CF4000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.730094342.0000000000CF4000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb+ source: ORDER-NEW....pdf.exe, 00000000.00000000.716135209.00000000082D2000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.740801711.00000000082D2000.00000004.00000001.sdmp
Source: Binary string: C:\Users\user\Desktop\ORDER-NEW....pdf.PDBh source: ORDER-NEW....pdf.exe, 00000000.00000000.708210872.0000000000CF4000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.730094342.0000000000CF4000.00000004.00000001.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdba source: ORDER-NEW....pdf.exe, 00000000.00000002.730604414.0000000000EC8000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.708566677.0000000000EC7000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.698387590.0000000000EC7000.00000004.00000020.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb* source: ORDER-NEW....pdf.exe, 00000000.00000000.716149183.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.706455152.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.740808600.00000000082D5000.00000004.00000001.sdmp
Source: Binary string: System.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: (P3o0C:\Windows\mscorlib.pdb source: ORDER-NEW....pdf.exe, 00000000.00000000.708210872.0000000000CF4000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.730094342.0000000000CF4000.00000004.00000001.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: System.Core.ni.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: System.Windows.Forms.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: mscorlib.pdb source: ORDER-NEW....pdf.exe, 00000000.00000002.730604414.0000000000EC8000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.708566677.0000000000EC7000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.698387590.0000000000EC7000.00000004.00000020.sdmp, WER450B.tmp.dmp.9.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: ORDER-NEW....pdf.exe, 00000000.00000000.716149183.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.706455152.00000000082D5000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.740808600.00000000082D5000.00000004.00000001.sdmp
Source: Binary string: ORDER-NEW....pdf.PDB source: ORDER-NEW....pdf.exe, 00000000.00000000.708210872.0000000000CF4000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.730094342.0000000000CF4000.00000004.00000001.sdmp
Source: Binary string: C:\Users\user\Desktop\ORDER-NEW....pdf.PDB source: ORDER-NEW....pdf.exe, 00000000.00000000.708210872.0000000000CF4000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000002.730094342.0000000000CF4000.00000004.00000001.sdmp
Source: Binary string: System.Drawing.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: mscorlib.ni.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: c:\Projects\VS2005\mailpv\Command-Line\mailpv.pdb source: AppLaunch.exe, 00000005.00000002.933455184.0000000007E95000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000002.933674801.0000000009480000.00000004.00020000.sdmp, AppLaunch.exe, 00000005.00000002.933041044.0000000006FAE000.00000004.00000001.sdmp, AppLaunch.exe, 00000005.00000003.692797770.0000000008705000.00000004.00000001.sdmp, vbc.exe, vbc.exe, 00000012.00000000.843177172.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000012.00000000.842483097.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000012.00000002.844335097.0000000000400000.00000040.00000001.sdmp
Source: Binary string: System.Core.pdb source: WER450B.tmp.dmp.9.dr
Source: Binary string: \??\C:\Users\user\Desktop\ORDER-NEW....pdf.PDB[ source: ORDER-NEW....pdf.exe, 00000000.00000002.730604414.0000000000EC8000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.708566677.0000000000EC7000.00000004.00000020.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.698387590.0000000000EC7000.00000004.00000020.sdmp
Source: Binary string: System.ni.pdb source: WER450B.tmp.dmp.9.dr

Data Obfuscation
barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_05437504 push E801025Eh; ret 5_2_05437509
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054374FC push E802005Eh; retf 5_2_05437501
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054360CF push es; ret 5_2_054360D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_0543326C push ss; retf 5_2_0543326D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_054332F5 push ss; retf 5_2_054332F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Code function: 5_2_0543F28C push 850FD83Bh; ret 5_2_0543F291
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00444975 push ecx; ret 8_2_00444985
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00444B90 push eax; ret 8_2_00444BA4
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00444B90 push eax; ret 8_2_00444BCC
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00448E74 push eax; ret 8_2_00448E81
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0042CF44 push ebx; retf 0042h 8_2_0042CF49
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_00412341 push ecx; ret 18_2_00412351
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_00412360 push eax; ret 18_2_00412374
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_00412360 push eax; ret 18_2_0041239C
PE file contains sections with non-standard names
Source: ORDER-NEW....pdf.exe Static PE information: section name: )xrUhX
Source: ORDER-NEW....pdf.exe Static PE information: section name:
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_004443B0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 8_2_004443B0
Source: initial sample Static PE information: section name: )xrUhX entropy: 7.99978046274

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe File opened: C:\Users\user\Desktop\ORDER-NEW....pdf.exe:Zone.Identifier read attributes | delete Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00443A61 memset,wcscpy,memset,wcscpy,wcscat,wcscpy,wcscat,wcscpy,wcscat,GetModuleHandleW,LoadLibraryExW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 8_2_00443A61
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: AppLaunch.exe, 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: AppLaunch.exe, 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp Binary or memory string: WIRESHARK.EXE
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT MacAddress FROM Win32_NetworkAdapterConfiguration
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 5892 Thread sleep count: 146 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 5892 Thread sleep time: -146000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 7164 Thread sleep count: 134 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 7164 Thread sleep time: -134000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Last function: Thread delayed
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0040978A memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle, 8_2_0040978A
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0041829C memset,GetSystemInfo, 8_2_0041829C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0040938F FindFirstFileW,FindNextFileW,wcslen,wcslen, 8_2_0040938F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00408CAC FindFirstFileW,FindNextFileW,FindClose, 8_2_00408CAC
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_0040702D FindFirstFileA,FindNextFileA,strlen,strlen, 18_2_0040702D
Source: ORDER-NEW....pdf.exe, 00000000.00000002.733095475.0000000003C71000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.699217663.0000000002C20000.00000004.00020000.sdmp Binary or memory string: virtualMachine
Source: Amcache.hve.9.dr Binary or memory string: VMware
Source: Amcache.hve.9.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.9.dr Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: Amcache.hve.9.dr Binary or memory string: VMware, Inc.
Source: bhvF129.tmp.8.dr Binary or memory string: https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20220121T000947Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=222178a1e1114cf5ab744bb5c0e1dbd6&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1351077&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1351077&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: ORDER-NEW....pdf.exe, 00000000.00000002.733095475.0000000003C71000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.699217663.0000000002C20000.00000004.00020000.sdmp Binary or memory string: ValueTypeDecryptionFileUnblockerVirtualMachineGetVmSInstallClassKnownFolderFlagsEnumKfKnownFolder<>c__DisplayClass1_0<>cProgramRrRunPersistenceSafeNativeMethodsStartClassStartupShortcutResourcesFm.PropertiesSettingsApplicationSettingsBaseSystem.ConfigurationIWshShellFm.IWshRuntimeLibraryIWshShell2IWshShell3IWshShortcutWshShell__StaticArrayInitTypeSize=16<PrivateImplementationDetails>
Source: Amcache.hve.9.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr Binary or memory string: VMware7,1
Source: Amcache.hve.9.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr Binary or memory string: VMware, Inc.me
Source: ORDER-NEW....pdf.exe, 00000000.00000002.733095475.0000000003C71000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.699217663.0000000002C20000.00000004.00020000.sdmp Binary or memory string: .cctorGetFolderPath2installFolderGetInstallFolderGetSpecialFolderfolder.ctorByteArrayToStringdataMd5HashDataSaveDatafileNameAdataAWatpathtxtAzpackageCountdicoptionsCompressNewMethodSomnisormillisecondsWobjectmethodInvokevalueBeginInvokeIAsyncResultAsyncCallbackcallbackEndInvokeresultEFList`1listbinaryReaderDecryptplainBytespassPhraseUnblockPathUnblockFilefileNameDetectVmvirtualMachineSandieget_Hostset_Hostget_MachineNameset_MachineNamehostmachineNameTryInstallexecPathinstallPathstartupFolderkeyNamevalueNameoptionsDelayTimeCmdCopyoriginalPathnewPathGetPathknownFolderdefaultUserGetDefaultPathInitializeflagsSetPathkeyMain<.cctor>b__1rn<.cctor>b__1_0senderbargsImgTDataimagesReadMResNewStringBuilderlongnumberseedSignalnameTryClaimmutexWaittimeoutMonitorSpawnlingstateReclaimMutexBeginMonitorSpawnlingprocessSpawnNewProcessBeginReclaimMutexWaitForCloseSignalBeginWaitForCloseSignalCloseSiblingsDeleteFilekernel32ShGetFhwndOwnernFolderhTokendwFlagspszPathSHGetFolderPathshell32.dllShGetrfidppszPathSHGetKnownFolderPathShell32.dllShSetSHSetKnownFolderPathGetMdlpModuleNameGetModuleHandlekernel32.dllComputeGetTimeStampDicIList`1parametersGetHostPathindexdefaultPathLocalPathStartFilefilemodeYinstalFolderInstallFolderCompareFileSizesf1f2SrkDecompressMphparamMrgRunPe1newpathbytearrayBytesexePathCssget_ResourceManagerget_Cultureset_Cultureget_clsRPget_Default_VtblGap1_4CreateShortcutPathLinkget_FullName_VtblGap1_9get_TargetPathset_TargetPath_VtblGap2_2get_WorkingDirectoryset_WorkingDirectory_VtblGap3_1iCreateMemberRefsDelegatestypeIDCreateGetStringDelegateownerTypeSetProcessWorkingSetSizeEventArgsAttachAppGetstringIDHostMachineNameCultureDefaultFullNameTargetPathWorkingDirectoryAssemblyDescriptionAttributeAssemblyConfigurationAttributeAssemblyCompanyAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyTitleAttributeComVisibleAttributeTargetFrameworkAttributeSystem.Runtime.VersioningGuidAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyTrademarkAttributeAssemblyFileVersionAttributeSuppressIldasmAttributeFlagsAttributeCompilerGeneratedAttributeGeneratedCodeAttributeSystem.CodeDom.CompilerDebuggerNonUserCodeAttributeTypeIdentifierAttributeDefaultMemberAttributeCoClassAttributeAttributeUsageAttributeAttributeTargetsSTAThreadAttributeDispIdAttributeEditorBrowsableAttributeSystem.ComponentModelEditorBrowsableStateFm.Properties.Resources.resourcesFm.Resources.clsRP.xlgCharInt32IntPtrZeroEmptyMD5CryptoServiceProviderExceptionget_ItemReadAllBytesContainsProcessIdStreamReaderBooleanAddByteDoubleInt64SByteInt16SingleUInt32UInt64UInt16ReadBytesRijndaelManagedCryptoStreamModeIEquatable`1RegistryLocalMachineExternalExceptionFunc`2System.CoreEnumerableSystem.LinqFirstOrDefaultIEnumerable`1ArgumentExceptionPointInvalidOperationExceptionLastEventResetModeParameterizedThreadStartThreadStartICollection`1get_CountCurrentUserDeflateStreamSystem.IO.CompressionCompressionModeResolveTypeHandleGetFieldsFieldInfoBindingFlagsget_CharsResolveMethodHandl
Source: Amcache.hve.9.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: ORDER-NEW....pdf.exe, 00000000.00000002.733095475.0000000003C71000.00000004.00000001.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.699217663.0000000002C20000.00000004.00020000.sdmp Binary or memory string: VirtualMachine
Source: Amcache.hve.9.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Anti Debugging
barindex
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_0040978A memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle, 8_2_0040978A
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_004443B0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 8_2_004443B0
Enables debug privileges
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process token adjusted: Debug Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process queried: DebugPort Jump to behavior
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 1156 Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Sample uses process hollowing technique
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Section unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Section unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000 Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 445000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 451000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 454000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 3AB008 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 413000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 417000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 419000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 291008 Jump to behavior
.NET source code references suspicious native API functions
Source: 5.0.AppLaunch.exe.400000.0.unpack, u200d????????????????????????????????????????.cs Reference to suspicious API methods: ('?????????????????????????????????????????', 'FindResource@kernel32.dll'), ('?????????????????????????????????????????', 'capGetDriverDescriptionA@avicap32.dll'), ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll'), ('?????????????????????????????????????????', 'ReadProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')
Source: 5.0.AppLaunch.exe.400000.4.unpack, u200d????????????????????????????????????????.cs Reference to suspicious API methods: ('?????????????????????????????????????????', 'FindResource@kernel32.dll'), ('?????????????????????????????????????????', 'capGetDriverDescriptionA@avicap32.dll'), ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll'), ('?????????????????????????????????????????', 'ReadProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')
Source: 5.0.AppLaunch.exe.400000.3.unpack, u200d????????????????????????????????????????.cs Reference to suspicious API methods: ('?????????????????????????????????????????', 'FindResource@kernel32.dll'), ('?????????????????????????????????????????', 'capGetDriverDescriptionA@avicap32.dll'), ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll'), ('?????????????????????????????????????????', 'ReadProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')
Source: 5.2.AppLaunch.exe.400000.0.unpack, u200d????????????????????????????????????????.cs Reference to suspicious API methods: ('?????????????????????????????????????????', 'FindResource@kernel32.dll'), ('?????????????????????????????????????????', 'capGetDriverDescriptionA@avicap32.dll'), ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll'), ('?????????????????????????????????????????', 'ReadProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')
Source: 5.0.AppLaunch.exe.400000.2.unpack, u200d????????????????????????????????????????.cs Reference to suspicious API methods: ('?????????????????????????????????????????', 'FindResource@kernel32.dll'), ('?????????????????????????????????????????', 'capGetDriverDescriptionA@avicap32.dll'), ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll'), ('?????????????????????????????????????????', 'ReadProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')
Source: 5.0.AppLaunch.exe.400000.1.unpack, u200d????????????????????????????????????????.cs Reference to suspicious API methods: ('?????????????????????????????????????????', 'FindResource@kernel32.dll'), ('?????????????????????????????????????????', 'capGetDriverDescriptionA@avicap32.dll'), ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll'), ('?????????????????????????????????????????', 'ReadProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')
Allocates memory in foreign processes
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 1156 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpB254.tmp Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpB202.tmp Jump to behavior
Source: ORDER-NEW....pdf.exe, 00000000.00000000.699115256.0000000001690000.00000002.00020000.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.709749986.0000000001690000.00000002.00020000.sdmp, AppLaunch.exe, 00000005.00000002.932216392.00000000057E0000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: ORDER-NEW....pdf.exe, 00000000.00000000.699115256.0000000001690000.00000002.00020000.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.709749986.0000000001690000.00000002.00020000.sdmp, AppLaunch.exe, 00000005.00000002.932216392.00000000057E0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: ORDER-NEW....pdf.exe, 00000000.00000000.699115256.0000000001690000.00000002.00020000.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.709749986.0000000001690000.00000002.00020000.sdmp, AppLaunch.exe, 00000005.00000002.932216392.00000000057E0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: ORDER-NEW....pdf.exe, 00000000.00000000.699115256.0000000001690000.00000002.00020000.sdmp, ORDER-NEW....pdf.exe, 00000000.00000000.709749986.0000000001690000.00000002.00020000.sdmp, AppLaunch.exe, 00000005.00000002.932216392.00000000057E0000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection
barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Queries volume information: C:\Users\user\Desktop\ORDER-NEW....pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ORDER-NEW....pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_00418137 GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy, 8_2_00418137
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 8_2_004083A1 GetVersionExW, 8_2_004083A1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: 18_2_004073B6 memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy, 18_2_004073B6

Lowering of HIPS / PFW / Operating System Security Settings
barindex
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.9.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe

Stealing of Sensitive Information
barindex
Yara detected MailPassView
Source: Yara match File source: 18.0.vbc.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.7f31990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.9480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.94d834a.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.9480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.AppLaunch.exe.875dbda.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.7f31990.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.vbc.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.7e95950.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.9480345.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.94d834a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.AppLaunch.exe.8705890.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.AppLaunch.exe.875dbda.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.AppLaunch.exe.8705bd5.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.AppLaunch.exe.8705890.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.933455184.0000000007E95000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.843177172.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.933041044.0000000006FAE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.842827239.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.933674801.0000000009480000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.692797770.0000000008705000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.842483097.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.843631196.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.844335097.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 7160, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 4296, type: MEMORYSTR
Yara detected HawkEye Keylogger
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.689728198.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.930832405.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.690486770.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.703620754.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.690115034.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.733884470.00000000047C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.702281950.00000000047C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.691070548.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.712572110.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.738563781.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.711229338.00000000047C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ORDER-NEW....pdf.exe PID: 6860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 7160, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail Jump to behavior
Tries to steal Mail credentials (via file registry)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, PopPassword 18_2_00402D74
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, SMTPPassword 18_2_00402D74
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Code function: ESMTPPassword 18_2_004033B1
Yara detected WebBrowserPassView password recovery tool
Source: Yara match File source: 8.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.9480345.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.9480000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.9480000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.vbc.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.7e95950.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.vbc.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.9480345.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.AppLaunch.exe.8705bd5.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.7e95950.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.AppLaunch.exe.8705890.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.AppLaunch.exe.8705bd5.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.3.AppLaunch.exe.8705890.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000000.702441264.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.933455184.0000000007E95000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.933674801.0000000009480000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.704117458.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.692797770.0000000008705000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.702788844.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.715632355.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000000.703279347.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 7160, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vbc.exe PID: 6356, type: MEMORYSTR
Tries to steal Instant Messenger accounts or passwords
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Dynamic Salt Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 7160, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected HawkEye Keylogger
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.19.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.23.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4a73c3c.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.24.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.4afe15c.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5af10f4.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5b7b560.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.21.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.5b7b560.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4afe15c.20.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.5af10f4.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.4a73c3c.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.AppLaunch.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.ORDER-NEW....pdf.exe.49e970c.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ORDER-NEW....pdf.exe.49e970c.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.689728198.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.930832405.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.690486770.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.703620754.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.690115034.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.932528508.0000000006EA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.733884470.00000000047C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.702281950.00000000047C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.691070548.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.712572110.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.738563781.0000000005AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.711229338.00000000047C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ORDER-NEW....pdf.exe PID: 6860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 7160, type: MEMORYSTR
Detected HawkEye Rat
Source: ORDER-NEW....pdf.exe, 00000000.00000002.733884470.00000000047C0000.00000004.00000001.sdmp String found in binary or memory: _Version_Mutex_Delivery_EmailUsername_EmailPassword_EmailServer_EmailPort_EmailSSL_FTPServer_FTPUsername_FTPPassword_FTPPort_FTPSFTP_ProxyURL_ProxySecret_PanelURL_PanelSecret_LogInterval_PasswordStealer_KeyStrokeLogger_ClipboardLogger_ScreenshotLogger_WebCamLogger_SystemInfo_Install_InstallLocation_InstallFolder_InstallFileName_InstallStartup_InstallStartupPersistance_HistoryCleaner_ZoneID_HideFile_MeltFile_Disablers_DisableTaskManager_DisableCommandPrompt_DisableRegEdit_ProcessProtection_ProcessElevation_AntiVirusKiller_BotKiller_AntiDebugger_ExecutionDelay_FakeMessageShow_FakeMessageTitle_FakeMessageText_FakeMessageIcon_WebsiteVisitor_WebsiteVisitorVisible_WebsiteVisitorSites_WebsiteBlocker_WebsiteBlockerSites_FileBinder_FileBinderFiles
Source: ORDER-NEW....pdf.exe, 00000000.00000000.703620754.0000000005AF1000.00000004.00000001.sdmp String found in binary or memory: _Version_Mutex_Delivery_EmailUsername_EmailPassword_EmailServer_EmailPort_EmailSSL_FTPServer_FTPUsername_FTPPassword_FTPPort_FTPSFTP_ProxyURL_ProxySecret_PanelURL_PanelSecret_LogInterval_PasswordStealer_KeyStrokeLogger_ClipboardLogger_ScreenshotLogger_WebCamLogger_SystemInfo_Install_InstallLocation_InstallFolder_InstallFileName_InstallStartup_InstallStartupPersistance_HistoryCleaner_ZoneID_HideFile_MeltFile_Disablers_DisableTaskManager_DisableCommandPrompt_DisableRegEdit_ProcessProtection_ProcessElevation_AntiVirusKiller_BotKiller_AntiDebugger_ExecutionDelay_FakeMessageShow_FakeMessageTitle_FakeMessageText_FakeMessageIcon_WebsiteVisitor_WebsiteVisitorVisible_WebsiteVisitorSites_WebsiteBlocker_WebsiteBlockerSites_FileBinder_FileBinderFiles
Source: AppLaunch.exe, 00000005.00000000.689728198.0000000000402000.00000040.00000001.sdmp String found in binary or memory: _Version_Mutex_Delivery_EmailUsername_EmailPassword_EmailServer_EmailPort_EmailSSL_FTPServer_FTPUsername_FTPPassword_FTPPort_FTPSFTP_ProxyURL_ProxySecret_PanelURL_PanelSecret_LogInterval_PasswordStealer_KeyStrokeLogger_ClipboardLogger_ScreenshotLogger_WebCamLogger_SystemInfo_Install_InstallLocation_InstallFolder_InstallFileName_InstallStartup_InstallStartupPersistance_HistoryCleaner_ZoneID_HideFile_MeltFile_Disablers_DisableTaskManager_DisableCommandPrompt_DisableRegEdit_ProcessProtection_ProcessElevation_AntiVirusKiller_BotKiller_AntiDebugger_ExecutionDelay_FakeMessageShow_FakeMessageTitle_FakeMessageText_FakeMessageIcon_WebsiteVisitor_WebsiteVisitorVisible_WebsiteVisitorSites_WebsiteBlocker_WebsiteBlockerSites_FileBinder_FileBinderFiles
Source: AppLaunch.exe, 00000005.00000002.930832405.0000000000402000.00000040.00000001.sdmp String found in binary or memory: _Version_Mutex_Delivery_EmailUsername_EmailPassword_EmailServer_EmailPort_EmailSSL_FTPServer_FTPUsername_FTPPassword_FTPPort_FTPSFTP_ProxyURL_ProxySecret_PanelURL_PanelSecret_LogInterval_PasswordStealer_KeyStrokeLogger_ClipboardLogger_ScreenshotLogger_WebCamLogger_SystemInfo_Install_InstallLocation_InstallFolder_InstallFileName_InstallStartup_InstallStartupPersistance_HistoryCleaner_ZoneID_HideFile_MeltFile_Disablers_DisableTaskManager_DisableCommandPrompt_DisableRegEdit_ProcessProtection_ProcessElevation_AntiVirusKiller_BotKiller_AntiDebugger_ExecutionDelay_FakeMessageShow_FakeMessageTitle_FakeMessageText_FakeMessageIcon_WebsiteVisitor_WebsiteVisitorVisible_WebsiteVisitorSites_WebsiteBlocker_WebsiteBlockerSites_FileBinder_FileBinderFiles
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 557358 Sample: ORDER-NEW....pdf.exe Startdate: 21/01/2022 Architecture: WINDOWS Score: 100 30 Malicious sample detected (through community Yara rule) 2->30 32 Antivirus detection for URL or domain 2->32 34 Antivirus / Scanner detection for submitted sample 2->34 36 11 other signatures 2->36 7 ORDER-NEW....pdf.exe 1 2->7         started        process3 signatures4 38 Hides that the sample has been downloaded from the Internet (zone.identifier) 7->38 10 AppLaunch.exe 5 7->10         started        13 WerFault.exe 23 9 7->13         started        15 WerFault.exe 7->15         started        process5 signatures6 40 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->40 42 Writes to foreign memory regions 10->42 44 Allocates memory in foreign processes 10->44 46 2 other signatures 10->46 17 vbc.exe 1 10->17         started        20 vbc.exe 10->20         started        process7 signatures8 22 Tries to steal Mail credentials (via file registry) 17->22 24 Tries to harvest and steal browser information (history, passwords, etc) 17->24 26 Tries to steal Instant Messenger accounts or passwords 20->26 28 Tries to steal Mail credentials (via file / registry access) 20->28
⊘No contacted IP infos